Loading malware…
VAMP is an Android spyware family used in targeted cyberespionage and associated with Arid Viper, also known as Desert Falcon and APT-C-23. It records telephone calls and steals contacts, messages, and documents stored on infected devices, enabling surveillance of victims’ communications and collection of sensitive personal information.
VAMP has appeared in a multi-platform espionage toolkit alongside the Windows malware families KASPERAGENT and MICROPSIA and the Android downloader SECUREUPDATE. Broader campaigns involving this toolkit targeted users primarily in the United States, Israel, the Palestinian territories, and Egypt, with some media organizations also targeted. VAMP shares code and functionality with other Android spyware associated with Arid Viper, including FrozenCell and later SpyC23 variants. These relationships link it to the actor’s continuing development of mobile surveillance tooling, but do not establish that all capabilities of those related families are present in VAMP.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
VAMP, designed to steal data through call recording and stealing contacts and documents stored on the device.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.
Retrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension
The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video
97 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as one of several malware signatures TuxBot attempts to kill on infected devices.
Older Arid Viper Android spyware family noted as sharing overlaps with newer SpyC23 variants.
Android spyware designed to steal data via call recording and theft of contacts and documents from the device.
Android espionage malware used by Desert Falcons to record calls and steal contacts and documents.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.